---
title: "Create event source"
method: POST
path: "/event_sources"
tags: ["EventSources"]
---

# Create event source

`POST /event_sources`

## Request

- Base URL: `https://api.crevio.co/v1`
- URL: `https://api.crevio.co/v1/event_sources`
- Auth: API key in header `Authorization`

Creates an external event source. Two kinds:

- **Connected-app trigger** (default): deploys a third-party trigger. The account must have previously connected the underlying app (Gmail, Slack, Calendar, etc.) at /integrations. Use `GET /event_sources/available?app=...` to discover the `vendor_component_id` values. `configured_props` carries only that trigger's own settings (label, sheet, channel, filters) — the connected account it runs as is resolved automatically from the linked app, and the deploy fails with a message naming the app if none is connected.
- **Inbound webhook** (`vendor: "webhook"`): a Crevio-hosted URL any service (Typeform, Stripe, GitHub, Zapier, a custom script) can POST JSON to. `event_name` is a short name (e.g. `typeform_applications`); the source's `event_name` becomes `webhook.<name>`. The response's `inbound_url` carries an unguessable token and is the credential — treat it as a secret. Set `signature_required: true` to also require an HMAC-SHA256 signature (`X-Hub-Signature-256`, `Typeform-Signature`, `X-Signature`, or Standard Webhooks headers); the signing secret is shown only to the account's admins in the Crevio app, never over the API. Unknown or inactive URLs answer 404; bodies over 1 MB answer 413.

Once active, every delivery fires `external.<event_name>` and any AiTask with `trigger_type: "event"` + matching `event_conditions.event_type` runs with the delivered payload as `event.data`.

## Headers

- `Idempotency-Key` string

## Request body

- EventSourceRequest
  - `vendor` 'pipedream' | 'webhook'
  - `vendor_component_id` string, nullable
  - `event_name` string
  - `description` string, nullable
  - `signature_required` boolean
  - `configured_props` object

## Response `201`

Event source created

- EventSource
  - `id` string, required
  - `object` string, required
  - `vendor` 'pipedream' | 'webhook', required
  - `vendor_trigger_id` string, nullable, required
  - `vendor_component_id` string, nullable, required
  - `event_name` string, required
  - `configured_props` object, required
  - `description` string, nullable, required
  - `signature_required` boolean, required
  - `active` boolean, required
  - `last_delivered_at` string, date-time, nullable, required
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required
  - `qualified_event_name` string, required
  - `inbound_url` string, nullable, required

## Other responses

- `400`: Bad request
- `401`: Authentication required
- `403`: Forbidden
- `422`: Validation error
- `429`: Rate limit exceeded — 600 requests per minute per credential. Retry after the number of seconds in `Retry-After`.
- `500`: Internal server error

---

[API](https://skmtc.dev/crevio/apis/crevio-api-v1.md) · [All operations](https://skmtc.dev/crevio/apis/crevio-api-v1/llms.txt) · [OpenAPI document](https://skmtc.dev/crevio/apis/crevio-api-v1/revisions/2219f18ad651?raw)